ScamShield

Inspiration

Scam messages are now part of daily life. A fake bank KYC alert, a "parcel held, pay a small fee" text, or a "digital arrest" call can reach anyone, and the people hit hardest are often parents and grandparents who have no quick way to check a message before acting. We wanted something as easy as pasting the message and getting a straight answer, without sending private messages to a server.

What it does

ScamShield analyzes a suspicious SMS, WhatsApp message, email, or URL and instantly returns:

• A 0-100 risk score with a verdict: Safe, Suspicious, or Likely Scam
• Every red flag highlighted directly in the pasted text
• A plain-English explanation of why each flag is dangerous
• A "What to do now" checklist (don't click, never share your OTP, report it, block the sender)
• A one-click report summary you can copy and share

It catches urgency pressure, OTP/PIN/CVV requests, fake KYC and refund notices, lottery bait, digital-arrest and courier threats, investment and job-task scams, remote-access app requests, and lookalike domains like paypa1.com. Everything runs 100% in the browser, so nothing is uploaded.

How we built it

ScamShield is a single-file web app in vanilla HTML, CSS, and JavaScript with no dependencies and no backend. The core is a weighted heuristic engine with two parts:

• Message analysis: pattern matching across scam categories, with each signal carrying a weight that feeds the overall score.
• URL analysis: checks for shorteners, raw IPs, "@" tricks, punycode and homoglyphs, suspicious TLDs, excessive subdomains, missing HTTPS, and brand names inside fake domains. Typosquatting is caught with Levenshtein distance against a list of well-known brand domains.

The UI has a dark security theme, an animated risk gauge, inline highlighting, and six one-click example scenarios for instant demos. We used Google Antigravity as an AI coding agent to speed up implementation, and we designed the detection logic and scoring approach ourselves.

Challenges we ran into

• Balancing false positives and false negatives: urgent but legitimate messages, like a real bank OTP notice, can look similar to scams, so weights needed tuning until the safe example scored low and the scam examples scored high.
• Lookalike domains: flagging near-matches like amaz0n-support.com without flagging real sites required careful thresholds.
• Explaining, not just scoring: a number alone doesn't teach anyone anything, so every flag needed a clear, non-technical explanation.
• Time: building, testing, and recording a demo inside a tight hackathon window meant ruthless scoping.

Accomplishments that we're proud of

• A fully working, privacy-first tool that needs no signup, server, or API keys
• Instant, explainable results that help users learn to spot scams themselves
• Detection covering scam types that are common in India and worldwide, such as digital-arrest threats, fake KYC, and courier fee scams
• A one-file build that deploys anywhere in seconds

What we learned

• Most scams rely on the same psychological levers (urgency, fear, greed, authority), so even a simple heuristic engine catches a lot.
• Explainability builds trust: users act on a warning when they understand the reason behind it.
• Privacy is a feature. Keeping analysis on-device makes people far more willing to paste sensitive messages.
• Scoping tightly and testing early matters more than piling on features.

What's next for ScamShield

• ML classifier: train a model on labeled scam and safe messages to complement the heuristics
• Browser extension: warn users on suspicious links and pages in real time
• WhatsApp/Telegram bot: forward a message and get a verdict in-chat
• Multilingual support: Hindi and other regional languages, where many scams circulate
• Community reporting: an opt-in way to flag new scam patterns so detection keeps improving

Built With

• client-side
• css3
• cybersecurity
• github
• google-antigravity
• heuristics
• html5
• javascript
• levenshtein-distance
• netlify
• phishing-detection
• regex